@fidacy/langchain for Python

Gate LangChain tool calls behind a Fidacy verdict. Wraps the tool itself, not a callback: LangChain callbacks fire around a call and cannot cancel it, so a guardrail built on them watches the money leave. This one stops it.

pip install fidacy-langchain

from fidacy_langchain import guard_tools

# No key, no signup: the offline judge decides your first 20 calls.
tools = guard_tools([pay_tool, search_tool])

pay_tool is judged before every call. search_tool is returned untouched, so tools that do not move money pay no cost at all.

Two ways it decides

Offline, out of the box. With no credential the deterministic local judge runs: deny-by-default, your own limits, a hash-chained log on your machine. The first 20 decisions on an install are free and need no account, so you can watch a payment get blocked before deciding whether you want any of this.

from fidacy_langchain import Mandate, guard_tools

tools = guard_tools([pay_tool], mandate=Mandate(
    payees=["acme-inc"],
    per_tx_max=5_000,
    max_total=50_000,
))

A blocked call tells you what was stopped, in money terms, and prints the exact edit that would allow it:

Fidacy stopped send_payment: USD 4,200 to "acme-inc" is over the USD 1,000
per-payment limit. That limit is Fidacy's starting default, not something you
set. To allow a payment this size, set your own:

  guard_tools([send_payment], mandate=Mandate(per_tx_max=4200, payees=["acme-inc"]))

No money moved and the attempt is on this install's audit trail. 19 free
decisions left.

It also names impersonation. pay0neer against an approved payoneer is not reported as an unknown payee: it is reported as the vendor being spoofed, which is the signature of a payee swap.

The judge is the same one the Node packages run

The rules live in one place, packages/firewall/vectors/judge.json, and both the TypeScript and Python implementations run those cases and must return the exact same rule string. A firewall that decided differently depending on the language your agent happens to be written in would not be worth trusting.

Trial state is shared

The free-decision counter lives in ~/.fidacy/config.json, the same file @fidacy/mcp uses. Adding this package does not hand you a fresh 20, and the history you build anonymously migrates when you claim an account.

Free key, no card: https://fidacy.com/claim

Anonymous telemetry

The adapter reports anonymous usage so we can tell which surfaces are alive: an install marker, an "agent active" ping, the result class of local decisions (allow, deny_payee, deny_cap and so on) and the moment the free-trial wall is shown. Every field is a closed enum. It never carries payees, amounts, currencies, tool arguments or any content, and it never sits on the path of a decision: failures are swallowed and nothing blocks.

Disable it entirely with:

export FIDACY_DISABLE_TELEMETRY=1

The anonymous id lives in ~/.fidacy/config.json, shared with @fidacy/mcp and the JS adapters, so the free-decision counter and a later account claim stay consistent across Fidacy tools on the same machine.

Apache-2.0 · https://fidacy.com